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(57) Abstract: There is provided an unauthorized operation judgment system forjudging whether an operation received by a com- 
puter is an unauthorized operation by referencing a profile to find a peculiar action. This system can cope with an unauthorized 
operation due to a change of a computer by an authorized user and an unauthorized operation by a new user whose user profile is 
not yet created. When a user executes a certain operation, the operation tendency and the operation tendency executed by the user 
are learned to create a node profile and a user profile, which are stored in a node profile state table and a user profile state table 
of each user, respectively. The node profile and the user profile thus created are referenced so as to perform deviation calculation 
between the operation received and the normal operation pattern, thereby judging whether the operation is peculiar and calculating 
the possibility of an unauthorized operation as a score value. 



WO 2005/048119 Al liinDlilDfflllUIDlIDDIIlIlllIili 



NI, NO, NZ, OM, PG, PH, PL, PT, RO, RU, SC, SD, SE, 
SG, SK, SL, SY, TJ, TM, TN, TR, TT, TZ, UA, UG, US, 
UZ, VC, VN, YU, ZA, ZM, ZW. 

(84) m^mm^coui^). ±T<Dmm<D&m&m#'*j 

fife;: ARIPO (BW, GH, GM, KE, LS, MW, MZ, NA, SD, 
SL, SZ, TZ, UG, ZM, ZW), l~r>7 (AM, AZ, BY, 
KG, KZ, MD, RU, TJ, TM), 3 — P (AT, BE, BG, 
CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HU, IE, 
IT, LU, MC, NL, PL, PT, RO, SE, SI, SK, TR), OAPI (BF, 



BJ, CF, CG, CI, CM, GA, GN, GQ, GW, ML, MR, NE, SN, 
TD, TG). 



